Use VirusTotal with
Sokko.
Connect VirusTotal and tell Sokko what to do. It runs the actions you ask for and reacts to what happens. No workflows, no code.
Works with 1,000+ tools · No code required
Actions
Everything Sokko can do in VirusTotal
Every VirusTotal action Sokko can run. Ask for one in a sentence and it's done.
Add VirusTotal Comment
Tool to add a comment to a VirusTotal resource (file, URL, domain, or IP address). Use after analyzing a resource to leave contextual feedback. Provide exactly one identifier per call.
Add Vote
Tool to add a vote (harmless/malicious) to a VirusTotal resource. Use after reviewing analysis results to submit your verdict.
Get Analysis Report
Tool to retrieve the analysis report of a file or URL submission. Use after obtaining an analysis ID to fetch its detailed report. Analysis results may be incomplete immediately after submission; poll until the report status is 'completed' before treating results as final.
Get comments
Tool to retrieve the latest comments on a VirusTotal resource. Use when you need to review user-generated comments for a file, URL, domain, or IP after obtaining its identifier.
Get Domain Relationships
Tool to retrieve relationship objects for a given domain. Use when you have a domain and need to explore its related entities.
Get Domain Report
Tool to retrieve the analysis report of a domain. Use when you need detailed insight on a domain's reputation and analysis stats. No malicious signals on obscure or low-traffic domains may indicate limited analysis history rather than safety — treat sparse results as 'unknown', not 'safe'. Covers external OSINT only (reputation, malware, SSL posture); cannot analyze internal/private assets.
Get File Report
Tool to retrieve the analysis report of a file. Use when you have a file's hash and need detailed scan metadata. Recently submitted files may return partial results; retry after a short delay before treating the report as final.
Get IP Address Relationships
Tool to retrieve objects related to a specific IP address by relationship type. Use when you have an IP and need to explore connected files, URLs, or other entities.
Get IP Address Report
Tool to retrieve the analysis report of an IP address. Use when you need detailed insight on an IP's reputation, ASN, country, and analysis stats. Low or zero detections indicate unknown risk, not safety — treat sparse data accordingly. Provides external OSINT only; insufficient as standalone compliance evidence.
Get VirusTotal Metadata
Tool to retrieve VirusTotal metadata. Use when you need information about available privileges, relationships between resources (like files, domains, IPs, URLs), and supported antivirus engines.
Get URL Report
Tool to retrieve the analysis report of a URL. Use when you have a URL identifier (base64-url without padding) and need detailed scan results, reputation, and metadata. Results may be incomplete immediately after submission; retry with short delays if scan engines are still processing before treating the report as final.
Get Votes
Tool to retrieve votes on files, URLs, domains, or IP addresses. Use when you need to view community votes for a given object.
Rescan File
Tool to re-analyze a previously submitted file. Use when you need updated analysis results after an initial scan.
Scan URL
Tool to submit a URL for scanning. Use when you have a URL and need to submit it to VirusTotal to obtain an analysis ID for later retrieval. The returned analysis ID is preliminary — scanning engines may not have finished. Poll VIRUSTOTAL_GET_URL_REPORT with the ID using short delays to retrieve complete results.
Search VirusTotal
Tool to search for objects in the VirusTotal database. Use when locating files, URLs, domains, IPs, or comments matching a query. Supports pagination with limit and cursor.
Upload File
Tool to upload a file for scanning. Use when you have binary file content ready to submit for VirusTotal analysis.
Get connected
Live in your Slack in two minutes.
No workflows to wire up. Turn on the tools you already use, and your agent gets to work.
Add to Slack
1
Add Sokko to Slack
One click from the Slack marketplace. Your whole team gets Sokko at once.
2
Connect your tools
Sokko works with 1,000+ apps and any MCP server.
Martin
9:53 AM
@Sokko
What can you do with VirusTotal?
3
Put Sokko to work
@mention Sokko in any channel and it gets going. Minutes, not a weekend.
Questions, answered.
Sokko is an AI assistant that lives in your Slack. Connect your apps, ask for what you need in plain language, and Sokko takes the work off your plate.
Sign up to Sokko, ask Sokko to connect to VirusTotal, and approve the connection when prompted. From then on you can ask Sokko to do things in VirusTotal whenever you need.
No. There's nothing to build or configure. You ask Sokko in Slack the same way you'd ask a colleague, and Sokko handles the rest.
Yes. Ask once and tell Sokko when to repeat it, like every Monday at 9am, and it becomes a routine that runs without you.
Read and act on data in VirusTotal, and trigger workflows when something changes there. Tell Sokko the outcome you want and it handles the rest.
Yes. Sokko connects to 1,000+ apps and any MCP server, so you can ask for tasks that span VirusTotal and the rest of your stack in a single request.